f00732b465c6e717deb99e016ad29a4fe58c24807b69a53239d0abb8112bc5da

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 06:06

Target

2024-01-11_d4c84b7d1ddecd3ee63d96cbf97f8eba_mafia.exe
Size

163KB
MD5

d4c84b7d1ddecd3ee63d96cbf97f8eba
SHA1

d77609f7d99c2ec24bf588ddd68f6ec938118023
SHA256

f00732b465c6e717deb99e016ad29a4fe58c24807b69a53239d0abb8112bc5da
SHA512

3e3f347855ff756a1e696d4ca0c9f6e2a9168f789df01a293350bd0d66c34124d70e816b8445e8aaf95153b1ae32301014dc4f0440709f77658381685d279327
SSDEEP

3072:5z5PAJdZYJhdJQLqOTTh3y1Q2Y6kysW66JkFTOFl:51PmrYJOxi17yyn0Sv

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2576	2940	2024-01-11_d4c84b7d1ddecd3ee63d96cbf97f8eba_mafia.exe	30
PID 2940 wrote to memory of 2576	2940	2024-01-11_d4c84b7d1ddecd3ee63d96cbf97f8eba_mafia.exe	30
PID 2940 wrote to memory of 2576	2940	2024-01-11_d4c84b7d1ddecd3ee63d96cbf97f8eba_mafia.exe	30
PID 2940 wrote to memory of 2576	2940	2024-01-11_d4c84b7d1ddecd3ee63d96cbf97f8eba_mafia.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-01-11_d4c84b7d1ddecd3ee63d96cbf97f8eba_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_d4c84b7d1ddecd3ee63d96cbf97f8eba_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir "./logs/"
  2⤵
  PID:2576